Thanks, I didn't realize it had finally come available. Looks like it's not an option, as it's for a v7 board w/emmc, and the image isn't available without buying their hardware package.
I do wish pfSense had said upfront that it would not be available without the hardware. There's literally no reason for them to have stated that they were working on a port and try to appropriate the espressobin userbase when it would be only sold as yet another proprietary box. I feel a bit shafted when he did say things like:

Assuming he has a publically routable IP address. I've been bitten by ever-increasing amounts of people wondering why dynamic dns doesn't work when they're (unknowingly) behind NAT.
@sunarowicz : if you're having connection problems, check the first two octets of your wan connection against the list of reserved private IP spaces.

I think you have two different technologies confused.
Pi-Hole works by acting as a DNS server, and simply redirecting any DNS requests for sites on it's blocking lists with blank/null/innocuous content.
This can be located anywhere inside your network that is reachable by your other devices, and, as it only handles the DNS requests, does not require a lot of processing or network capacity. I'd recommend a wired device, but yes, a pi zero with an ethernet dongle would handle the traffic for an average home network admirably. Something with built-in ethernet would obviously be better from a reliability standpoint (eg. nanoPi neo, orangePi zero, etc)
What I think you're looking for is more than ad-blocking, but an actual stateful firewall with packet inspection. For that you'd need to go with beefier hardware. Personally, I'm still waiting on a pfSense release for the espressobin for that, but what kind of hardware specs you need will depend on your network throughput and traffic.

I remember reading the history of the Lima project a while ago, and it basically comes down to that ARM doesn't WANT an open-source implementation of the graphics drivers, as they make a not-insignificant amount of money licensing theirs.

If you check the download page under "Libre Computer", you'll see that Armbian has builds for 4 of their current models
Le Potato is a supported board
Tritium H3 & H5 are suitable for testing
Renegade is a "community support" board.
The link you provided by default points to the new La Frite board, who just recently finished it's kickstarter and nobody actually has yet.
For the most part you'll find the boards are roughly comparable to their Orange Pi and FriendlyArm analogues of the same processor / memory.

The major difference between those three images is:
Stretch : modern 4.x (14? 17?) kernel, based on Debian
Bionic: modern 4.x (14? 17?) kernel, based on Ubuntu
Xenial: legacy 3.4 kernel, based on Ubuntu
The modern kernels are generally pretty-close-to-mainline linux, thanks to the hard work of the guys in the linux-sunxi group.
Since not everything has been reverse-engineered, it doesn't (yet) support all the device features.
h3consumption will not work with the modern kernels, so is not included
The legacy kernel is based off a vendor-provided kernel that has been cleaned up and had a few dozen (hundred) security patches on top of it.
It's based of the now end-of-life 3.4.y kernel tree that was initially released in 2012 and was marked end-of-life in 2016 following the final 3.4.113 update
All the hardware should work with these kernels, but the anything that relies on a modern kernel (eg. btrfs) won't work, and you'll be missing the last 2 years of security/stability updates.